Employee Privacy In Canada: Key Considerations For Employers

It can be astonishing to realize how much private information an employer has about its employees.

A typical employer will have compensation, immigration status, social insurance number, banking and direct deposit information, birth date, family status, and dependents as well as medical information that is necessary for dealing with requests for accommodation or leaves.

The risk of a serious privacy breach or identity theft is real. Much of this personal information is available with a few clicks of a mouse.

The law is often behind technological developments. The Office of the Privacy Commissioner of Canada (“OPC”) released guidelines in 2023 for employers. These guidelines, developed in collaboration with various federal, provincial, and territorial privacy commissioners and ombuds, recommend increased legislation and regulatory oversight. 

The law

Canada is a federation and privacy regulation across the country is a patchwork. Quebec, Alberta, British Columbia, and federally regulated companies are subject to privacy legislation that governs the employment relationship. The other provinces have not yet enacted legislation about employee privacy, but employers in those provinces should still be very careful. Employers with unionized employees should also be aware that they are subject to privacy laws that have developed in the context of collective bargaining and arbitral jurisprudence.

Privacy law in Canada is complex and continues to evolve. Employers should monitor the progress of Bill C-36, the Protecting Privacy and Consumer Data Act, which proposes significant reforms to Canada's private-sector privacy regime. Although the Bill has not yet been enacted, it underscores the trend toward stronger organizational accountability and privacy governance. For a more detailed analysis of the proposed legislation, please see our previous article, “Ottawa tables long-awaited federal privacy reform legislation.”

The basics

Employers should be proactive not just with safeguarding client data, but also with employee data.

Employers should consider:

• What information do employers actually need to have about candidates and employees?
• How is that information stored?
• How are they protecting sensitive data, such as social insurance numbers, health information, and financial information?
• Who has access to the information?
• How long is the information kept?
• How are they preventing misuse of employee information?
• How are they training employees about confidentiality, privacy, data breaches, identity theft, and phishing?
• Are employees aware of the seriousness of a breach of confidentiality?

Certain industries have additional sensitivities and considerations for employee personal information, including health care, banking, financial services, and education.

Technological changes

Technology permits surveillance and the collection of employee data far beyond what was possible even a decade ago. Employers can use GPS data on vehicles, cellphones, and laptops to pinpoint an employee’s location at all times. Keystroke monitoring and biometrics are just two commonly used ways that employers monitor workers.

In Ontario, employers with more than 25 employees must disclose in writing their policies on electronic monitoring.Given the speed of technological change, this policy should be updated annually or whenever there is a major technological change in how the employer uses monitoring technology. For more information, consult our previous article, “New requirement in Ontario for enhanced transparency on electronic monitoring in the workplace.”

Privacy professionals and regulators encourage employers to think about necessity, reasonableness, and proportionality when implementing electronic surveillance. Just because it can be done, does not mean it should be done or even needs to be done.

Electronic monitoring case law

There have been some notable cases where electronic monitoring has been used to support an employer’s case for dismissal. In 2023, a British Columbia employer was able to establish that a remote worker was charging for hours not actually worked.¹ The employer used TimeCamp to distinguish between work-related activities and other activities (such as streaming videos). The Civil Resolution Tribunal ruled that the employee had deliberately overbilled her employer and was guilty of time theft, which was just cause for termination.

Snooping is not permitted

“Snooping” seems an almost benign word, but it isn’t in the privacy context. In a blistering decision of the Information and Privacy Commissioner of Ontario (“IPC”), employees of Lakeridge Health were found to have accessed patients’ personal health data without authority. Even after Lakeridge Health found out about the snooping incidents, it did not remove the employees’ access to electronic health records before conducting an exhaustive investigation. The IPC criticized the delay in removing the employees’ access and required the hospital to reconsider its policies as to when an interim removal of access to electronic health records would be implemented.²

An employer’s biggest risk may be human

Many employees do not realize that accessing electronic information without a legitimate work reason could be a criminal offence. Section 342.1 of the Criminal Code makes the unauthorized use of computer services and systems a criminal offence and punishments could be as much as 10 years in prison.

People make mistakes and some people are sometimes less than honest. In many organizations, the greatest privacy risk does not come from hackers but from insiders who already have authorized access to sensitive information. Curiosity, convenience, carelessness, or deliberate misconduct can all lead to serious privacy breaches. Looking up a co-worker's records, accessing a customer's file without a business need, sharing confidential information with unauthorized persons, or falling victim to a phishing attack can expose both the employee and the employer to significant consequences.

Employers should ensure that employees understand that access to personal information is granted on a need-to-know basis and only for legitimate business purposes. Regular training, clear policies, access controls, audit logs, and prompt investigation of suspected misuse are essential safeguards. Employees should also understand that electronic systems often record who accessed information, when it was accessed, and what actions were taken. Unauthorized access is rarely invisible.

Conclusion

Employers are well-advised to be ahead of the law with respect to privacy. When deploying new systems or features, they should think about the privacy implications and how to avoid embarrassing and potentially extremely expensive privacy breaches. A data breach or identity theft can also expose employers to a civil claim for negligence. In addition to strong policies and good technological safeguards, employees must be trained and retrained to respect the privacy of their colleagues and clients. Mark Cuban has been quoted as saying that “information is power.” Employers have to make sure that information power is used properly by their employees.

Read the original article on GowlingWLG.com

Footnotes

1. Besse v. Reach CPA Inc., 2023 BCCRT 27

2. Lakeridge Health (re), 2026 CanLII 36854.